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Computer system with alterable bootstrapping software. 

@ A computer which canries its BIOS in a Flash 
EPROM. A UV-EPROM cames a redundant 
BIOS, which can be overlaid onto the BIOS 
. address space by selection with a physical 
switch. 

The BIOS contains a small core software 
program, at the BIOS entry point, which checks 
BIOS integrity, and provides for reloading the 
Flash EPROMS's BIOS if needed (from a floppy 
disk, or by copying the entire contents of the 
UV-EPROM). 
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The present invention relates to a computer system. 

Any computer system must have some way to begin program execution after a cold start The hardware 
architecture of a CPU (processor) will normally provide for a "reset" operation, which places all of the hardware 
circuits in a known electrical state; but it is still necessary to start the CPU on execution of a desired program. 

5 For example, in the very early days of computing, some computer systems would be manually configured to 
read in a "bootstrap loader" program at startup. This bootstrap program was a simple program which loaded 
in, and started execution of. another sequence of instructions, which were the beginning of the desired program. 
Bootstrap programs are often referred to simply as "boot" software. 

To give a more recent example, the Intel 80x86 microprocessors, after a hardware reset will always attempt 

10 to begin program execution from a specific memory address. That is. the microprocessor will read the contents 
of that memory location, and will attempt to execute the bits it finds there as a microprocessor instruction. Thus, 
if a branch (or conditional branch) instruction is found at this address, the microprocessor will continue its pro- 
gram execution from whatever address' is specified. The specific memory location used by the 80x86 family 
is xxxFFFFOh, i.e. 16 bits below the top of the memory space. Other microprocessors may use a different start- 

15 ing address, but similar principles apply. 

Thus, this initial target adress is the entry point for every session of use. This address is normally used to 
enter execution of programs which must be run every time the computer is used. 

Whatever hardware is used wi'! have its own procedures to return to a known state when a reset occurs. 
However, at some point these procedures end, and the CPU is ready to begin execution of instructions. 

20 At this point the system performs various overhead tasks under software control. These may include sur- 

veying the system configuration, sanity checks etc. 

In modern personal computers, the initial target address is normally used as the entry point to a "basic 
input/output system" (BIOS) program. The BIOS program contains frequently-used routines for interfacing to 
key peripherals, for interrupt handling, and so forth. 

25 Thus, the BIOS software provides some degree of machine-independence. However, in PC-class comput- 

ers, this Independence is not fully exploited by the available commercial software. Many programs bypass the 
BIOS software, and directly access the underlying hardware addresses or devices. See Glass, "The IBM PC 
BIOS", Byte, April 1989, pp. 303ff, In addition to these basic input/output routine's, the "BIOS" software also 
includes some key pieces of overhead software, such as configuration update and the power-on-self-test 

30 (POST) routines. 

The POST routines provide an extensive check for hardware integrity. The BIOS software will also launch 
the machine into the operating system software. 

Depending on how the system has been set up, the BIOS software may direct program execution into DOS, 
Unix, PS/2, a DOS variant, or another operating system. However, the choice of operating system is not par- 
35 ticularly relevant to the invention described in the present application. (Thus, the term "BIOS" has become 
somewhat broader nowadays, and normally refers to this whole collection of basic system routines.) 

If the BIOS software were to become corrupted, the computer could become unusable. Thus, the BIOS 
software has conventionally been stored in read-only memory (ROM). When the microprocessor attempts to 
access the initial target address, it reads out software from the BIOS ROM. 
40 In 1980 there was only one source for IBM-compatible BIOS software, and that was from IBM. However, 

during the 1980s, as IBM-compatible personal computers became more popular, modified versions of IBM-^ 
compatible BIOS ROMs were developed, and IBM compatible BIOS ROMs were offered by multiple vendors. 
As of 1 991 . BIOS software is often modified to implement system-dependent features, especially in low-power 
systems. 

45 improvements in BIOS software mean that sometimes it will be desirable to implement a BIOS upgrade. 

Dedicated users have successfully pried out and replaced ROM chips, but most users would not want this de- 
gree of hands-on contact. 

Some attempts have been made in the past to provide capability for updating the b-?s;c system software. 
See e.g., Bingham, D.B., "Achieving flexible firmware," 1978 MIDCON Technical Pap --=1 at 20/3/1-4(1978). 
50 It is believed that some vendors may have offererd upgradable-BIOS systems, i-owever, insofar as is 

known, no system has offered protection against corruption while updating BIOS. 

Without boot software, a computer could not run any program at all. Thus, corruption of the boot software 
can make a computer totally unusable. Thus, for security against such corruption, personal computers have 
commonly been manufactured with their BIOS software in nonvolatile memory chips. However, for rapid system 
55 development and upgrading, it is desirable to be able to rapidly provide new BIOS chips, or even to upgrade 
existing BIOS chips. Over years, a variety of developments in semiconductor device technology have been 
used to reconcile these needs. 

One of the simplest nonvolatile memories is the mask ROM. By custom-patterning one level of a chip, a 
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comptex pattern of data can be permanently encoded. For example, an array with polysilicon row lines ac- 
cessed by row decoders, and metat column lines accessed by column decoders, can have contact holes se- 
lectively etched, so that one bit of data is encoded at each row/column intersection. Alternatively, polysilicon 
row lines can be selectively linked to diffused column lines by metal shorting straps. With this technology, a 
5 new mask must be prepared whenever any bit of data is changed. In high volume, mask ROMs are reasonably 
cheap, but they are not suited for rapid upgrading. 

A "programmable read-only-memory." or PROM, can be electrically written. PROMs are typically built using 
solid-state fuses (or antifuses), which will become open (or shorted) whenever a high current is driven through 
them. Thus, the programming of a conventional PROM requires the application of a high voltage (e.g. 10 or 15 
10 V) to achieve the high currents needed. However, once the data has been written it is permanent. 

An "electrically programmable read-only memory." or EPROM, can be electrically written, and can be 
erased by ultraviolet light. EPROMs are typically built using a floating-gate avalanche MOS device. This is a 
MOS transistor with an additional isolated thin film (the floating gate) interposed between the MOS control gate 
and the channel. By pumping charge into the floating gate, the effective threshold voltage of the MOS transistor 
15 can be changed, and this threshold voltage change is detected by a sense amplifier. To write a cell, the channel 
is typically driven hard, with a high voltage on the control gate. Secondary carrier multiplication in the channel 
creates hot electrons, which are attracted into the floating gate. Thus the programming of a conventional 
EPROM requires the application of a high voltage (e.g. 10 or 15 V) to achieve the high currents needed. More- 
over, programming is typically quite slow, e.g. several milliseconds per bit. To erase a cell, it is exposed to ul- 
20 traviolet light. The energetic photons excite energetic carriers, which can pass through the dielectric layer to 
neutralize the charge on the floating gate. Thus EPROMs normally need a package with a quartz window. 
EPROMs are very commonly used, since they are cheap and their timing standards are familiar, EPROMs are 
also referred to as UVPROMs. 

An "electrically erasable programmable read-only-memory," or EEPROM or E^PROM, can be electrically 
25 written and electrically erased. EEPROMs, like EPROMS, are typically floating-gate devices. However, in an 
EEPROM the write and erase operations typically use tunnelling. Thus, the programming of a conventional EE- 
PROM requires the application of a high voltage (e.g. 1 5 or 20 V). Programming and erasure are typically quite 
slow, e.g. several milliseconds per bit. EEPROMS are less commonly used than EPROMs, since they tend to 
be more expensive and to require even higher voltages. 
30 A more recent modification of the EPROM is the "Flash EPROM." This device, like the EEPROM is elec- 

trically erasable, but only in blocks. Although this device does not have the bit-by-bit programmability of the 
EEPROM, it is still useful in many applications. 

A wide variety of rewritable nonvolatile memory technologies have been proposed, and doubtless others 
will continue to be proposed. For example, the computers of the 1950s and early 1960s used "core" memory 
35 technology, which is. to some extent, nonvolatile and rewritable. 

The disclosed computer system contains features which permit the boot software to be easily upgraded 
and protect against corruption of the boot software. The disclosed computer system may use Flash EPROMs 
or other memory technologies 

The disclosed system uses a rewriteable nonvolatile memory as the primary boot memory. For further se- 
40 curity against corruption of the boot software, the preferred system uses two boot memories. By selection with 
a hardware switch, either one can be connected as the boot source. 

Since either of the two boot memories may need to be the target, both boot memories are mappable to the 
same address. Note that this causes some difficulty in writing to the volatile boot memory: if the volatile boot 
memory is not in the memory map. it cannot be written to. 
45 In the presently preferred embodiment, this difficulty is avoided by mapping the core software out to RAM, 

and then commanding an address configuration change to access the other boot memory. If one boot memory 
is being copied onto the other, then the contents of the source memory must also be copied out. 

As noted above, the default mapping of the boot memory address, at initial power-up. is controlled by a 
physical switch. However, thereafter, a peripheral memory controller chip controls the mapping of the boot 
50 memory address. Thus, by issuing a command to this peripheral chip, the core software can change this map- 
ping. 

Thus, to write to the boot memory, the core software copies itself out to a RAM location, and commands 
the microprocessor to branch into the RAM address. The bit to select the boot memory is then toggled, so that 
writes to the boot memory addresses are now directed to the other boot memory (i.e. to the boot memory which 
55 was not the source of the code being executed). The desired data can then be written into the target boot mem- 
ory. Note that, if the source of the data is in the active boot memory, that code must be written out into RAM 
before the boot memory address toggle is switched. 

The starting address in the boot software is occupied by a small (and strongly protected) software core, 
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which performs sanity checks, and also provides the needed supervisory functions for boot software upgrading 
and replacement. 

Thus, the disclosed computer system solves the problem of performing BIOS restoration/upgrades in-situ 
(i.e. without removing the FL^SH boot memory ROM from the system). The end-user (or a service technician) 
5 can program BIOS code into the FLASH without any specialized extenal hardware or software ROM-program- 
ming tools. 

After any hard reset of the system, the core software detects whether the boot software Is corrupted, and 
whether the user has entered a request for upgrade. If these conditions have occurred, the core software per- 
forms the FLASH programming from the appropriate data source. 
10 In the presently preferred embodiment, the core software provides for the following three classes of cases. 

These cases together provide coverage for all conceivable field conditions: 

First case: 

15 While executing reset code from the FLASH, the system BIOS and/or video BIOS are found to have a bad 

checksum. In this case, power-on-seif-testand booting is impossible, therefore, the boot code prompts the user 
to insert a diskette containing system and video BIOS code and reprograms the FLASH. 

In the presently preferred embodiment, this is done with the assistance of a small 4-character diagnostic 
display which is mounted directly on the system chassis. This display is referred to as SmartVuTf^. When the 

20 system and video BIOS programming Is successfully completed, the user Is prompted (via SmartVu) to reset 
the system. Normal POST and boot should follow. 

Second case: 

25 While executing reset code from the FLASH, the boot code detects a "CMOS" flag setting indicating a user 

requested upgrade. (Personal, computers normally contain a battery-backed CMOS memory which stores con- 
figuration parameters; in system discussions, this memory is often referred to merely as the "CMOS" although 
non-CMOS memories can be used). The boot code then prompts the user (via SmartVu) to insert a diskette 
containing the upgrade system and video BIOS code. When the system and video BIOS programming is suc- 

30 cessfully completed, the user is prompted (via SmartVu) to reset the system. Normal POST and boot should 
follow. 

Third case; 

35 While executing reset code from the UVPROM. the boot code detects that a FLASH is present and that Its 

protected 8k boot sector is jumpered for programming. Since the UVPROM Is Intended as a secondary ROM 
device, this condition is understood as a request for FLASH programming and the entire contents of the UV- 
PROM, including the boot code In the upper 8k sector Is copied into the FLASH. When the entire FLASH is 
successfully programmed, the user is prompted to reset the system. If the FLASH Is selected as the primary 
40 ROM device, normal POST and boot should occur from the FLASH. 

Note that the foregoing steps may require the CPU to ascertain, while it is running boot code, which memory 
is the source of the code. This is accomplished, in the presently preferred embodiment, by letting the CPU read 
a register in a peripheral chip. 

The preferred rewritable boot memory is a sector-protected Flash-EPROM. The sector which contains the 
45 software core is actually protected by a jumper, which must be physically moved before the software core can 
be overwritten. This provides additional robustness. 

Because the core software may have to read from floppy disk, it includes the necessary overhead routines 
to perform this. These routines are generally similar to the BIOS functions under INT13h. 

The invention provides a computer system including a rewritable non-volatile memory which holds boot- 
so strapping instructions including Instructions capable of effecting the over-writing of instructions held in the re- 
writable non-volatile memory, from an external source, following a hard reset of the system. 

The invention also provides a computer system Including a rewritable non-volatile memory and a second 
non-volatile memory which holds bootstrapping instructions including Instructions capable of effecting the 
over-writing of instructions held in the rewritable non-volatile memory from an external source, and means for 
55 selecting either the second non-volatile memory or the rewritable non-volatile memory as its source of boot- 
strapping instructions, following a hard reset of the system. 

The first non-voltaile memory may be a mask ROM. PROM or UVPROM which holds the basic system 
operating instructions Including the bootstrap and BIOS Instructions required for system activation. Those In- 
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structions may be substantially unalterable, and the systenn can be activated or reactivated by placing it under 
the control of the first non-volatile memory 

Preferably, the bootstrapping instructions held in the second non-volatile memory are such as to effect 
the over-writing of instructions held in the rewritable non- volatile memory by the bootstrapping instructions held 
5 in the second non-volatile memory, following a hard reset of the system. 

The rewritable non-volatile memory may be a FLASH EPROM or an electrically programmable and eras- 
able ROM to which can be written instructions, including instructions which effect the writing of instructions 
from an external source to the rewritable non-volatile memory. Thus, instructions can be written to the rewritable 
non-volatile memory and the rewritable non-volatile memory can then be used as the source of activating in- 
10 structions for the computer system, with the flexibility that the computer system can itself rewrite at least some 
of the instructions held in the rewritable non-volatile memory. The computer system can be returned to the op- 
erating configuration provided by the instructions held in the first non-volatile memory at any time by means 
of a user-operated switch, say. 

Preferably, the computer system includes manually operable means which has a first setting for preventing 
f5 the over-writing of instructions held in the rewritable non-volatile memory and a second setting permitting the 
over-writing of instructions held in the rewritable nonvolatile memory. 

The provision of a means which is only operable manually to inhibit the over-writing of selected instructions 
held in the rewritable non-volatile memory makes it possible to protect those selected instructions from acci- 
dental alteration. 

20 Preferably, the instructions are such as to make the computer system capable of writing the instructions 

from the second non-volatile memory to the rewritable non-volatile memory so that the instructions held in the 
second non-volatile memory can be readily written to the rewritable non-volatile memory. 

Preferably, the computer system includes a user settable switch for selecting the second non- volatile mem- 
ory as its source of bootstrapping instructions and is capable of reversing the switch setting to select the re- 
25 writable non-volatile memory as its source of activating instructions thereafter. That is, the computer system 
is capable of activation in accordance with the instructions held in the second non-volatile memory, following 
which it can write those instructions to the rewritable non-volatile memory, after which it switches control to 
the rewritable non-volatile memory. 

Preferably, the computer system includes multi-element diagnostic display means capable of indicating the 
30 result of an operation to over-write instructions held in the rewritable non-volatile memory. 

The diagnostic display means may be a multi-character display, for example, a 4-character display linked 
to a sub-system for checking on whether the writing of system and video BIOS has been successful and pro- 
viding an apparopriate indication. 

The first non-volatile memory may be rewritable and include means capable of preventing its data from 
35 being overwritten. That is. the first non-volatile memory may, in practice, be a rewritable non-volatile memory 
with substantial protection against its data being overwritten. 

The invention provides a method of operating a computer system including the steps of writing bootstrap- 
ping instructions from a second non-volatile memory to a rewritable non- volatile memory following a hard reset 
of the system and, thereafter, reading the bootstrapping instructions from the rewritable nonvolatile memory 
40 in bootstrapping the computer system. 

Preferably, the method of operating the computer system includes the steps of reading initial bootstrapping 
instructions from the rewritable nonvolatile memory in bootstrapping the computer system and overwriting the 
remaining instructions in the rewritable non-volatile memory with data from an external source. 

Preferably, the method of operating the computer system includes the steps of reading bootstrapping in- 
45 structions from the rewritable non-volatile memory, subjecting the bootstrapping instructions to validity checks 
as they are read and, when a validity check is failed, overwriting the bootstrapping instructions held in the re- 
writable non-volatile memory with the bootstrapping instructions held in the second nonvolatile memory. 

The method for operating the computer system may comprise the steps, whenever the system has under- . 
gone a hard reset, of immediately performing the following operations in a programmable central processing 
50 unit (CPU): 

if the said CPU is executing software from a rewritable nonvolatile boot memory. 

performing a checksum operation on the basic system software in the said rewritable nonvolatile 
boot memory, and. if a checksum error is found, 

prompting the user to provide a data source for the basic system software, and thereafter, 
55 reprogramming the said rewritable nonvolatile boot memory from the data source provided by the 

user. 

A modified method of operating the computer system comprises: 

reading at least one bit from a predetermined data location, and if the said bit is in a first state, 
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prompting the user to provide a data source for the basic system software, and thereafter, 
reprogramming the said rewritabole nonvolatile boot memory from the data source provided by 

the user. 

If the said CPU is executing software from a second nonvolatile boot memory which is not the same as 
5 the said rewritable nonvolatile boot memory and if the said rewritable nonvolatile memory is not currently write- 
protected. THEN the contents of the said rewritable nonvolatile memory are overwritten with the contents of 
the second non-volatile boot memory. 

The method of operating the computer system may comprise the steps, whenever the system undergoes 
a power-up transition, of immediately performing the following operations in the system microprocessor: 
10 ascertaining whether the said microprocessor is currently executing boot software from a rewrit- 

able nonvolatile boot memory or from a second nonvolatile boot memory which is not the same as the said 
rewritable boot memory but which is mappable onto the same address as the said rewritable boot memory, 
if the said microprocessor is executing software from said rewritable boot memory, 

performing a ch- . ^sum operation on the basic system software in the said rewritable boot mem- 
15 ory, and if a checksum error found. 

prompting the L:;?r to provide a data source for the basic system software, and thereafter, 
reprogramming ir.e said rewritable boot memory from the data source provided by the user, fol- 
lowed by prompting the user to reboot the system. 

The method of operation at a power-up transition may include reading at least one bit from a pre- 
20 determined data location and if the said bit is in a first state, prompting the user to provide a data source for 
the basic system software, and thereafter, 

reprogramming the said rewritable boot memory from the data source provided by the user fol- 
lowed by prompting the user to reboot the system. 

If the said bit is not in the first state, the system executes a power-on-self-test routine from the said rewrit- 
25 able boot memory. 

If the said microprocessor is executing software from said second boot memory and if said rewritable non- 
volatile memory is not currently write- protected the system copies the entire contents of the said second boot 
memory and overwrites the contents of the said rewritable nonvolatile boot memory, thereafter prompting the 
user to reboot the system. 

30 If any other condition exists, the system executes a power-on-self-test routine from the said second boot 

memory. 

The method for operating -jne computer system may comprise, during normal operation, the steps of: 
executing a sequence of instructions in at least one CPU which can fetch instructions in a programmable 
sequence from a memory; 

^5 initiating a system reset operation which includes a step of resetting the said CPU when a power restor- 

ation or software reset command occurs, 

executing in the said CPU. substantially immediately after the said step of resetting the said CPU, a core 
software program, stored in a rewritable nonvolatile boot memory, which tests the integrity of data in the said 
rewritable boot memory, and prompts the user to supply replacement data for said rewritable boot memory is 

40 corrupt. 

If the said CPU executes the said core software program successfully, then a power-on-self-test program 
is executed subsequently in the said CPU. 

If the said CPU executes the said power-on-self-test software program successfully, then the said CPU is 
launched on the execution of operating system software. 
45 Preferably, the said rewritable nonvolatile boot memory consists essentially of a Flash EPROM or an elec- 

trically programmable and erasible read-only-memory. 

Preferably, the said second nonvolatile boot memory consists essentially of a programmable-read-only- 
memory which is not electrically erasable. 

The present invention will be described with reference to the accompanying drawings, which show embodi- 
50 ments of the invention wherein: 

Figure 1 is a flow chart which shows key of the invention. 

Fig. 2 shows a hardware configuration which permits switching between alternative boot memories in an 
embodiment of the invention. 

The preferred embodiment is an 80486-based EISA-bus PC system. General features of the EISA bus are 
55 described by Glass, "Inside EISA." Byte magazine November 1989. pp/ 417ff. and in the EISA specification. 
General features of the Intel 80486 are described by Sartore, "The 80486: A Hardware Perspective." Byte Ma- 
gazine IBM Special Edition, Fali 1989. pp. 67ff. Further detailed background on the 80486 may be found in the 
"80486 Programmer's Reference" and the "80486 Hardware Reference Manual." both available from Intel. 
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Many of the architectural features of this system are conventional in modern PC systems. However, several 
unusual features are used. One of these is the provision for dual boot memories, with hardware and software 
switching betwen them. Another notable feature is the use of the "SLOB" controller chip described below. 

In the presently preferred embodiment, the system motherboard includes a custom chip, referred to herein 
5 as the "SLOB" chip, which performs a variety of special functions. These include reset control, X-bus trans- 
ceiver control, and control of the boot memories and CMOS nonvoltaiie memory. 

The "X-bus." or "extension bus," is an extension of the system bus. but is not directly connected to it. In- 
stead, data is selectably transferred from the S-bus to the system bus, or vice versa, by bidirectional trans- 
ceivers. The X-bus is commonly used, in PC architectures, to provide easier loading requirements for a variety 
10 of devices on the motherboard. 

The software core, in the presently preferred embodiment, resides in the protected 8k boot sector of a 
FLASH ROM or in the upper 8k of a 128k UVPROM. Selection of the primary ROM device is accomplished via 
a physical switch. 

Figure 2 shows more detail of how this is implemented. The SLOB chip supplies chip enable (CE) signals 

15 separately to the FLASH EPROM 220 and to the UVEPROM 230 (and also to the NVRAM 240). An output en- 
able tine OE is connected to both boot ROMs, and address lines are also provided to both. A hardware switch 
provides a line ROMIN to the SLOB chip, to define which boot memory is the initial default target. 

In the presently preferred embodiment, the FLASH EPROM has sector-by-sector protection. (This feature 
is found in the 28F001B type chip available from Intel). 

20 In the presently preferred embodiment, one sector 220A, of only 8K bytes, is dedicated to the core software. 

This sector is protected by a hardware jumper, so corruption of the core software is unlikely. 

To achieve automatic programming of the Flash memory from a plug-in ROM, the hardware must provide 
a switching mechanism that allows software to boot from one source and then toggle between sources. This 
switchability is also required to access EISA configuration from Flash if running BIOS out of a plug-in ROM, 

25 A user settable hardware switch determines which boot memory supplies the boot code at power-up or 

cold boot. This switch sets the polarity of a bit called ROMIN which is decoded by the hardware control logic 
to enable the selected boot source. This bit is readable from and 1/0 port, so that software can determine the 
source of the boot code, i.e. ROM(blt=0) or Flash (bit=1). The software then has the ability to toggle subse- 
quently between accessing ROM or Flash by setting a bit that assumes the opposite state of ROMIN after a 

30 cold boot. This bit is called ROMEN and enables Flash when 0 and ROM when 1. This bit is readable as well 
as writable via an I/O port. This mechanism allows hardware to boot from ROM then gives software the ability 
to determine the presence of Flash memory and program Flash automatically by transferring the contents of 
the BIOS in ROM to the Flash. 

The chip referred to herein as the TRANE chip is a custom memory controller. Besides performing normal 

35 DRAM management functions, this chip also provides selection, by memory domains, of which memory areas 
will be cached or not. 

The actual implementation of the core software will now be described in detail by way of example only. It 
must be understood that this specific implementation is merely illustrative. 

Figure 1 is a flow chart which schematically shows key portions of the methods used in the computer sys- 
40 tem of the presently preferred embodiment. 

When the 80486 first comes out of reset, it comes up in real mode (but the high address bits are held high, 
so that the processor can go to the top of the 4-Gigabyte {32-bit) memory space. The processor accesses add- 
dress FFFFFFFOh. See Glass. "Protected Mode", Byte Magazine December 1989, pp. 377ff. 

45 Preferred Assembly Language Implementation 

The actual implementation of key portions of the core software, in the presently preferred embodiment, 
will now be given. The following listings in documented assembly language also contain a large number of in- 
formal comments. These comments do not necessarily define the scope of the invention, but will help to explain 
50 the motivation, structure, and working of the presently preferred embodiment. 

Some of the procedures actually used, in the presently preferred embodiment, will now be described in 
detail. Of course, it should be understood by those skilled in the art that the very specific implementation details 
given are not by any means necessary to the invention. The following wealth of detail is provided merely to 
assure compliance with the best mode requirements of U.S. patent laws. 
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Procedure 8KBOOT STRT 



Procedure 8kboot_strtis the power-on-reset entry point into the 8k boot 
5 sector code for a 128k FlJ^SH EPROM. This code along with a reset vector 
is located in the upper 8k boot sector of a 128k FLASH EPROM. The reset 
vector will be located at IfffOh (physical ROM address), and the start of this 
w routine wilJ be located at leOOOh (stan-of the Sk boot sector).' The reset vector 
will contain a NEAR jmp to this code, so execution will start in processor real 
mode, ROM native mode, at logical address OffffeOOOh. This procedure 
15 implements most of the steps in the flow chart of Figure 1, SpeciScally, this 
procedure: 

- Saves the state of EAX and DX for later use by POST. 

20 



25 



30 
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40 



45 



50 



55 



8 



-tN^nnno- <EP___0524719A2.I_ > 




EP 0 524 719 A2 



- Imtializes a base address for the DE^AM controller (the 

5 

TRANE chip, in the presently preferred embodiment). 

- Disable interrupts (NMI and INTR). 

- If warm boot, jmp into POST SHUTDOWN routine. 

'° - Else, if power-on check to see if we're running out of a 

UVPROM or the FLASH. 

- If FLASH, jump to the "bootFLASH" procedure which 

programs the flash if the BIOS is corrupted or if the user 
has requested an upgrade, 

- If UVPROM, jump to the "bootUVPROM" code which copies 

the UVPROM to the FLASH if a FLASH exists. 

- If either "bootFLASH" or "bootUVPROM" does not program 

the flash, control returns to "do_reboot" which displays 
a Smart Vu message and halts. NOTE: Because of the 
redundanc>' between this code and early parts of POST, 
(RESET, SHUTDOWN) the BIOS is NOT dependent on 
this code. This means that a working BIOS can be built 
for a 64k non-FLASH ROM architecture by simply 
removing this module from the build process. The 
original 64k BIOS reset/initialization logic has been left 
untouched. 

C00E8K SEGMENT USE16 PUBLIC 'CODE' 

40 

ASSUME cs;C0DE8K, dsrCODESK 

exlrn intl3h : nedr 
extrn initFd : near 
45 extrn dskprin : byte 
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fdcOOR equ 3F2h .-Digital output register, 

bit? = 0 Reserved. 

bit6 - 0 Reserved, 

bits = 1 Endble drive I motor. 

bit4 - I Enable drive 0 motor. 

bit3 -0 Enable floppy interrupts and DMA. 

bit2 - 0 Controller reset, 

bitl ■ 0 Reserved. 

bitO » 0 Select drive 0. 
- 1 Select drive 1. 



75 



20 



PUBLIC (?8kboot_strt 
06kboot_strt: 

; Save ax in high word of ebp, dx fn high word of esp. 
030 V bp, ax 
shl ebp,16 
oiov sp.dx 
shl esp, 16 



25 



; Disable primary and secondary caches. 486 cache comes up enabled so we wan 
; it OFF as fast as possible. 

OIS 486CACHE 



30 



Grab a base 10 address for TRAHE. The first 10 write address after 
power-on will be appropriated by TRANE for it's base address. 

nov a 1,0 ;Valid TRANE index for warm boot case. 

out TRANE_BASE,al - ;Duauny 10 write to set TRANE base. 



35 



40 



Flush secondary cache. 

mov dx,slob_portXX 

in al,dx 

or dl,slob_portXX_f lushBit 

out dx,dl 

and al,NOT s lob_portXX_f lushSi t .-Reset ext. cache flush, 

out dx.at 



;Hold ext. cache in flush. 



45 



; Turn off interrupts and NMI. 
cli 

mov al,NMIOFF+0Oh 

out NMIMSK.dl ;Turn off NMPs 
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WAFORIO 

in aUNMlMSK+1 

; CPU In fastest possible mode 

mov al,PITSL2+PITRLL+PITM0l 
out XPITMO.dl 

eld 

; Wann or cold boot? If cold boot» we do the 8k code, [f wana boot we 
15 ' ; bail into S8I0S reset logic. 

IN AL,UPISTA ;see if 8042 system bit on, 

TEST AL,04H ;b1t 2 of 8042 status port 

jz SHORT is_cold_boot ;If warm boot, haul ass! 



20 



25 



30 



35 



40 



shutdown code ° CMOS shutdown byte 
MOV AL,NMIOFF+CMSHUT 
OUT CMOSAD.AL 
WAFORIO 

IN AL^CMOSDT ;get CMOS shutdown byte 

MOV AH,AL 

This is a CPU reset, not a bus reset. In this case we may assume RAM 
is initialized and therefore RSTFLG can be used to determine the sense 
of shutdown Os . If it's a shutdown 0 and RSTFLG I234h, then it's a 
warn boot, else it's a shutdown that wants to act like a cold boot. 

cmp ah,0 ;Shutdown 0? 

jne is_wann_boot ;If not, warm boot. 

mov bx.ROMDAT 

mov ds,bx 

ASSUME 0S:ROMOAT 

ctnp RSTFLG, I234h ;CTRL-ALT-DEL ? 

ASSUME 0S:C00E8K 

je SHORT is_wann_boot ;If so, wann boot. 



; Switch to protected mode and do a FAR jxp to the ^G native node BIOS 

; to remain in the 8k boot code. 

is_cold_boot: 

mov sp, OFFSET pra_retptr 

jmp praode ;Protected mode entry routine. 

pm_retptr OW OFFSET ptn_ret 
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; If we're booting from FLASH, look for a corrupted BIOS or a user 
; requested upgrade. 
^ ; If we're booting from UVPROM, program the FLASH If U exists. 

poi_ret: raov da , s lob^extRom ;SLOB external ROM register. 

In al,dx 

test dl.slob_extRon»_roinIn ;dre we booting frora UVPROM or FLASH? 
Jz bootUVPROM ;booting from UVPROM. 

10 jmp bootFUSH ;booting from FLASH. 

Jc do_reboot ;0i splay error oessage. 

; Return here froo -bootUVPROM- or "bootFUSH- if FLASH programmed 
; successfully. Issue SoartVu message to reboot and wait forever. 
do_reboot: mov esi.eax ;Save SMARfVU message. 

;Make sure the checksun is still good, 
mov di, OFFSET cniosSutn_ret2 
imp cmosSun .-Checksums CMOS routine. 

cnosSuB ret2: 



15 



20 



;Beep and display error message. 

mov cx,800h ;Set frequency. 

25 mov di, OFFSET beep_ret 

jmp beep 

beep_ret: mov eax^esi .'Restore SHARTVU message, 

""ov cx,0 ;Delay forever, 

imp flash rasg ;Display error message 

30 

; Do a FAR jmp to the SBIOS reset ,logic at F000:E1FF. Restore the reset state 
; prior to the jmp. 

back2RM: mov dx, s lob_port.'a ;Access portXX. 

35 al,dx ;Read tn current value, 

waforio 

and aLnot s lob_portXX_f lhPrg;Disab le FLASH program/erase, 
out dx,al ;Write out the new value. 

40 PAR_RESET ;Reset parity flop at port 61h. 

;Make sure the checksum is still good, 
mov di. OFFSET craosSuo^ret 

jmp cmosSum ;Checksu:ns CMOS routine. 

craosSum ret: 0PSI2E 
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FrtORD PTR cs:redl_i(lt ; Interrupts from vector table (? Q. 



10 



Set 6*lc limits for all selectors, 

mov <ix,GDrO_8lCBOOT 

rnov ds,ax 

mov es,ax 

mov ss,ax 

mov fs,ax 

mov gs,ax 



15 



mov eax.crO 
and at, NOT I 
mov crO,edx 



;Real mode 



20 



25 



30 



; Set segments regs back to CPU reset defaults, 
xor ax, ax 
mov ds»ax 
mov es,ax 
mov ss,ax 
mov fs,ax 
mov gs,dx 

is_wann_boot: 

;Restore ax and dx to their reset values, 
shr esp, 16 
shr cbp,l6 

mov dx,sp .-Restore reset value of OX, 

mov ax, bp .-Restore reset value of AX. 



35 



OB Oeah 
OW OElFFh 
D'A OfOOOh 



;FAR jrap to SBIOS reset entry point. 
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Procedure BOOTUVPROM 
Procedure bootUVPROM coatains the 8k power-oa logic executed when 
a UVPROM is instaUed. When cold-booting from a UVPROM, this code is 
executed to look for a FLASH ROM and if present, attempts to copy the entire 
UVPROM contents into the FLASH. If FLASH programming is unsuccessful 
for any number of reasons, e.g., FLASH is not present, 8k boot sector is not 
jumpered for erase/programming, etc., d^en this routine just bails back into POST. 



PUBLIC bootUVPROM 
bootUVPROM PRCC NEAR 

oov sp, OFFSET $106_retptr 

jfflp J1nit__vll06 

n06_retptr DW OFFSET n06_^ret 

n06_ret: mov eax/RAMi ' 

tnov dx.SMARTVU 

out dx.eax 

; Initialize RAM. 

mov bp, OFFSET RAWinit_ret ;Point sp to near return address, 
jrap RAM_init ;Initiali2e Trane. 



;Map in the first available SIMM at 0-2Mb. 
RAMInit^ret: nov a t ,CMSMTPL+NMIOFF 
out CMOSAO,al 

in al,CMOSOr ;Get SthM map from CMOS, 

movzx bx,dt ;Sdve SIMM configuration in bx. 

tnov dh,al 

mov ax,GOro_4G ;4G data seg ... 

tnov ds,ax ;into ds. 

raov es,ax ;into es. 

findSIMM: bsf bp,bx ;Find first installed SIMM position, 

jni SHORT mapSIMM 
mov ax,G0rD_8KBOOT 
mov ss,ax 

jmp JR0M2post ;If none, do POST, 
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etapSIM^: nov dx.bp 

TRANE_CUT_IX TRANE_RCROM,d 1 ;Progr^m 1st SIMM at 0 as d ZSGkbit part. 

; Copy 8k boot from ROM to RAM at lUOOOh ( IM ♦ 120k - Ok), 
mov eax, ' x&K' 
mov dx,SMARTVU 
out dx,eax 

(Dov ecx,2000h SHR 2 ;8kb 2k DWORDs. 

oov edi»lleOOOh ;Destination in RAM above IM. 

oov esi ,Offf feOOOh ;Source in 4G ROM. 

eld ; Forward MOVSD. 

ADSI2E 

rep aovsd ;move 8k boot from 4G ROM to RAM above IM. 



; Check the RAM code against the ROM to verify the copy, (and validate RAM) 
oov eax, *8Kck' 
out dx,cax 

20 mov ecx,2000h SHR 2 ;Okb 2k DWORDs. 

mov edi,lleOOOh ;Destination string in RAM above IM. 
Bwv esi ,Off ffeOOOh ;Source string in 4G ROM. 

ADSIZE 

repe copsd ;Search for non-taatching DWORD. 

25 je SHORT jmp2RAM .-If RAM/ROM match then jump to the RAM code. 

; If the 8k boot in RAM is corrupted then assume that SINW is bad and mark 
; it out in CMOS. Go back and look for the next good SIMM. 

btr bx,bp ;Reset the current SIMM bit in the map. 

mov al .CMSMTPL+NMIOFF 
out CMOS AD, a I 
mov al,bl 

out CMOSOT.dt ;01 sable the SIW in the CMOS map. 

35 jtnp findSIMM ;Look for the next good SIf*1. 

; Jump into the 8k boot code that has been copied to RAM. 

jmp2RAM: JMPP GDTC_1M_RAM ;Load cs with selector for IM RAM code. 

^ .-Relocate the GOT. 

OPSIZE 

Igdt FWORD PTR cs : ram_gdt_ptr 



; Set up some stack. 
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mov dx,GOTD_STACK 
mov ss.ax 
mov sp.BOOOh 

5 

; initialize tinser and calibrate speed, 
pusha 

push ds 
call init_timer 
^0 call calb_spd 

pop ds 
popa 

; Disable the UVPRCM and enable the FLASH. 

75 

mov dx,stob_extRoia ; FL^SH/UVPROM enable register, 

in at,dx 

and a I, NOT s lob^extRotn^roraEn ; Enable FLASH, 
out dx.al 

20 

; Look for signature to determine FLASH presence. 

mov BYTE PTR fs : [f lash_CP] , f lash_si gnature 
mov al,fs;[f lash_SIG_to] ;Lo byte of signature, 

cmp al,FLASH_MAN__CO0E ;28F001B manuf. code? 

25 jne SHORT no_flash ;If not, FLASH not present, do POST. 

mov al,fs:[f lash_SIG_hi] ;Hi byte of signature. 

cmp al.FLASH_0EV_CO0E0 ;28F001B device code? 

je SHORT uvprooi2rain ;If so, go on. 

cmp al,FLASH_OEV COOEl ;Alternate 23F001B device code? 

30 

je SHORT uvproraSram ;If so, flash present. 

; Flash not present, so look for an EISA NVRAM. If none, then hang. 
no_flash: mov dx, s lob_conf igA 
35 in dl,dx 

test al, slob_conf igA_nvRdrnIn ;Is an NVRAM installed? 

jnz SHORT no_EISA_cfg ;lf not, hang, 

mov ax,GOTD_lH_RAM ;Stack segment in current code, 

racv ss,ax 

^ joip JROrt2post ;Got NVRAM for EISA, but no FLASH, so do POST. 

no_EISA_cfg: mov eax,'xESA' ;EISA CMOS not present, 

jcip do_reboot ;0i splay error message. 

45 
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; FLASH is present. 

; Copy and verify the 123k UVPROM into RAM. 
^ uvproin2raQ: mov edx,'xB*0' 

mov dx,SMARTVU 
out dx.edx 

mov dx.s lob_extP.ora ;FtASH/UVPROM enable register. 

10 in al,dx 

or a I ,s lob_extRora_ron£n ; Enable UVPROM 
out dx.al 

mov ecx,18000h SHR 2 
' mov edi,100000h ;Oestination in RAM above IM. 

mov esi ,Off feOOOOh ;Source in 4G ROM. 

mov ax,GDT0_4G ;4G data seg ... 

mov ds,dx ;into ds . 

mov es.ax 

eld ;Forward MOVSO. 

ADSIZE 

rep novsd ;move I28k UVPROM to RAM above IM. 

25 ; Check the RAM code against the ROM to verify the copy, (and validate RAM) 

mov eax, ' BIOc ' 

mov dx^SHARTVU 

out dx,eax 

mov ecx,18000h SHR 2 

mov edi.lOOOOOh .-Destination string in R;^M above IM. 

mov esi .OfffeOOOOh ;Source string in 4G ROM. 

Aosize 

repe cmpsd ;Search for non-match!ng DWORD. 

je SHORT erase flash ;If RAM/ROM match then erase alt of fUsh. 

35 

; RAM failed during the UVPROM copy. 

JMPP G0TC_8KBOOT ;Jump back to UVPROM. 

OPSrZE 

Igdt FVORO PTR cs:gdt_ptr 

; Mark out the current SIMM in CMOS and go back to look for the next 
; good SIMM. 

btr bx,bp ;Reset the current Sim bit in the map. 

^5 mov aUCMSMTPL+flMIOFF 
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out CMCSAD,dl 

out CMCSDT^al 
Jmp findSIMM 



.-Disable the SIMM in the CMOS map. 
;Look for the next good SIMM. 



10 



; Try to erase the 8k boot sector to see if it is jumpered for program/erase. 
crase_flash: tnov eax, ' c8K' 

mov dx.SMARTVU 

out dx,eax 



15 



;FLASH/UVPROM enable register. 



mov dx,s lob_extRom 

i n a I , dx 

and a I, NOT s lob_extRon__roinEn ; Enable FLASH, 

out dx.al 



20 



25 



call enab te^fPrograrn ; Enable flash programming. 

mov edi , f lash_8kboot ;£rase 8k boot sector, 

mov eax,'fE8K' ;failure erasing 8k boot sector, 

call crase_sector 

jnc eSVbios ;If not, erase S&V bios, 

mov ax,GDTO_lM_RAM 
mov ss^ax 

jmp JR0M2post ;If none, do POST. 



30 



35 



; Erase SBIOS & VBIOS. 
eSVbios: mov eax,'eBtO' 

mov dx.SMARTVU 

out dx,edx 

mov edi , f lash_SBIOS ;Erase SBIOS sector, 

mov eax,'f£S8' ;failure erasing SBIOS. 

call erase_sector 

jc do_reboot ;Oisptay error message. 



40 



45 



Program the flash SBIOS and VBIOS. 

mov eax, *pBIO' 

mov dx,SMARTVU 

out dx,eax 

mov edt,f lash_SB10S 

mov esi,100000h 

mov ecx,18000h 



;Oestinatlon (start address of FLASH). 
;Source data in RAM 9 I meg. 
;Program 64< SBIOS and 32k VBIOS. 
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mov eax/fPSV .-failure Programming S & V BlOSes. 

cdl I prograa^sector 
^ jc <lo_reboct ;0i splay error message. 

; Program the flash 8k boot. 

mov ea)( , ' p8K ' 

mov dx^SMARTVU 
1Q out dx,eax 

mov edi , f lash_8kboot jOestination (start address of Sic boot sector). 

mov esi.lleOOOh .-Source data in RAM 9 Imeg + L20k. 

mov ecx,2000h iProgram 8k boot sector. 

mov eax,'fP8K' ; failure Programming 8lC boot. 

'5 call prograo_sector 

jc do_reboot ;Di splay error message. 

; Flash programming successful. Cycle 'FLSH' and 'DONE' to the SmartVu 
; on a 2 second cycle while waiting for a power-cycle, 
mov ax.GOTD_lM_RAM 

mov ss.ax ;Point stack at code seg. 

f lash_prog_ok: mov eax/FLSH' 

mov cx,2 ;2 second delay, 

mov d1 , OFFSET fdone_nsg 
jmp flash_aisg ;0i splay 'FLSH' and wait for 2 seconds, 
fdone^msg: mov eax/DONE' ;0ONE message, 
mov cx,2 ;2 second delay, 

mov di, OFFSET f lash_prog_ok 
30 jmp flash_rasg 

JR0M2post: mov dx, s lob_extRoii ; FLASH/UVPP.OM enable register, 

in a I ,dx 

or a I ,s lob_extRom ronEn ; Enable UVPROM 

out dx.dl 

jrap back2RM 

bootUVPROM ENDP 

40 

Procedure BOOTFLASH 
Procedure bootFlash contains the 8K power-on logic executed when the 
45 system boots from the Rash. 
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The steps axe as follow: 

- Checksum the system and video BIOS (96K). 

- If checksum is good, go to I. 

- If checksum is bad, go to II. 

1. - Does the user request a BIOS upgrade? 

- If upgrade is selected, go to U. 

- If upgrade is not selected, we are done with this 
routine and shall go to do regular POST. 

n. - Reset the upgrade option to prevent an endless loop. 

- Initialize a lot of stuff. 

- Initialize 106 so that we have Smart Vu. 

- Slob initialization. 

- Trane initialization and get at least 2 meg 
of DRAM. 

- Initialize the refresh counter. 

- Set refresh page to 0 dirough the DMA 
controller. 

- Copy code to RAM and execute from RAM. 

- Set up stack. 

- Test and initialize timers. 

- CaUbrate count before first call to DLYIOO. 

- Set up the DMA controllers. 

- Set up the interrupt descriptor table. 

- Set up the interrupt controllers. 

- Initialize the floppy subsystem. 
' - Copy the BIOS from floppy. 
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Inputs: 



Outputs: 
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- If unsuccessful, display error message and halt. 

- Make sure we Lndeed have a valid BIOS in RAM. 

- Set the Flash up for programming. 

- Copy the BIOS from RAM to Flash. 

- If unsuccessful, display error message and halt. 

Native-mode, protected-mode, Trane has grabbed its I/O 
address. 

Either halts or go to do regular POST. 

If the BIOS checksum is good and no upgrade is requested, 

this routine will jump to do regular POST. 

If the BIOS checksum is bad or an upgrad is requested, then 

this routine will halt at the end. 



publ ic bootFUsh 
bootFlash proc near 



;Initialize the 106 so we can have ScrartVu. 

ciov sp, offset vll06_retptr 

jmp $init_vll06 
vll06_retptr dw offset vU06_ret 
vll06_ret: 

mov eax/Dell' ;Announce ourselves. 

40 oov dx,SNWRTVU 

out dx,edx 



45 



;Checksura the system and video BIOS. 

mov ax,G0T0_4G ;riat addressing. 
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mov ds^dx 

cmp dword ptr ds : [0FrF£E076n] . ' t leD ' 
jne badChksum 

;Do not do the byte checksum sirce we hdve the dv-ord XOR. 
if 0 

xor ecx.ecx 

mov cl,byte ptr ds: [0FFFF0002h] ; Video ROM size in 512-byte blocks, 
cmp cl,40h .-Greater than 32k. 

Ja badChksum ;Juinp if greater than 32k. 

cl,Gl ;Check for 0. 

Jz short bddChksuo ;JuiDp tf 0. 

shl ecx,9 ;Convert to bytes, 

add ecx,64M024 ;Add the size of the system ROM. 

^^'^ ; Initialize checksun. 

mov esi,0FFF£0000h initialize pointer to (4G-128K). 

;Set to increment. 

chkSumLoop: 
AOSIZE 

^o<^^b ;al has value, 

^h'dl ;Add value to ah. 

25 AOSIZE 

loop ChkSumLoop 

«h*ah ;8ios checksum good? 

jnz short badChkSun ;Juap if bad checkum. 

30 endif ;0 

;Check the XOR of the S6K BIOS. 

mov ebx, dword ptr ds : [0FFFEE842hl ;Get the system BIOS version, 
mov cx,50h/4 ;Do 20 dwords. 

mov esi ,OFFFEOOO0h 
xorLoopl: 
AOSIZE 
lodsd 

xor ebx,eax 
loop xorLoopl 
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mov cx,(96n024/4)-22 ;Do 24K dwords - 22 dwords. 
mov esi ,0FFFE0058h 
45 xorLoop2: 
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Aosize 

^ lodsd 

xor ebx,eax 
toop xorLoop2 

cmp ebx^dword ptr ds : [OFFFEOOSOh] 
10 jne short badChkSura ;Jump if bdd XOR. 

goodChkSun: 

mov eax, 'CMOS ' 
Bov dx,SMARTVU 
'5 out dx,eax 

;Now that the Bros is not corrupted, check if the user requests t BIOS upgrade. 
;F!rst, make sure we have not tost battery power to the CMOS RAM, 
mov al,CMOSr+NMIOFF ;Read CMOS status register 0. 

out CMOSA0,at 
wa forio 
in dl.CMOSDT 

test al,SOh ;01d we loose battery power? 

jz bdck2RM ;Jump if we lost power. 



20 



25 



30 xor ax, ax 



35 



;Second, make sure we have correct CMOS checksum. 

mov bx,2E10h+3080h ;bh - first location not to checksum. 

;bl » first location to checksum. 
(•Contains the running sum. 
mov cx,ax ; Temporary storage. 

chlcCMOSLoop: 

=ov al,bl ;Get location, 

out CMOSAD,al ;Read from CMOS, 

wa forio 
in al,CMOSDT 

cl'aE ;Tibulate word checksum, 

adc ch,0 

inc bl ;Next location. 

cmp bl,bh :OQne with checksum? 

jne short chkCMOSLoop ;Jump if not done yet. 



tnov al,2Eh+NMiOFF ;Read from high byte checksum. 

45 out CMOSA0,al 

waforio 
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in al.CWOSDT 
cnp al,ch 
jne bick2RM 



;Correct high byte checksum? 
;Juoip if CMOS is corrupted. 



10 



mow dl,2Fh+SMI0FF 

out CMOSAD.al 

wd for 10 

in al,CMOSDT 

cnp dl,cl 

jne back2RM 



;Read frcm low byte checksum. 



;Correct low byte checksum? 
;Jurop if CMOS is corrupted. 
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;Now, we are ready to inspect the "upgrade" indicators, 
mov aUCMUPGD+NMIOFF ;Read "upgrade" in<iicators. 
out CMOSAO.al 
wdforio 
in dUCMOSOT 

cmp al,55h ;Upgrade requested? 

jne back2RM ;Jutnp if upgrade not requested. 



25 



Upgrade: 
badChkSun: 

;If you reach this point, that means you either have a corrupted BIOS or the 
;user requests to upgrade the BIOS. In either case, the following code 
japplies to both. 
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;Reset the "upgrade" indicators to prevent an endless loop, 
mov dl,CMUPGD+NMIOFF ;Reset "upgrade" indicators, 
out CMOS AO, a I 
waforio 
mov dl,0 
out CMOS0r,dl 

jlnitialize Trane and grab at ledst 2M of ORAM, dnd also initidlize Slob. 

mov sp, OFFSET ini tStuf f_retptr;Point sp to near return address. 

joip initStuff ;Go and do the initialization. 

initStuf f^retptr dw OFFSET i ni tStuf f_ret ;Return address. 

initStuff ret: 
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;Set up a 32K stack at 080000h. 
roov edx,'zTAK' 
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rcov dx,SMARTVU 
out dx.eax 

CBOv ax.GOrO^STACK 
mov ss,ax 
mov sp.BOOOh 

;Set up the interrupt descriptor table. 
OPSIZt 

lidt fword ptr cs:idt_ptr 
db 2Eh,0Fh,0lh,lEh 
; dw (OFFSET idt_ptr)+O£O00h 



'5 ;Go to real node to do the floppy stuff, 

getrea I : 

mov eax, ' rflod* 
tnov dx^SMARTVU 
out dx.eax 
call rMode 

.'Initialize timer and calibrate speed, 
call init_tiner 
25 call cdlb_spd 

;Set up the DMA controllers, 

mov cax,'iOMA' 

mov dx,SMARTVU 

30 out dx,eax 

call setupOMA 

jnc short setupDMA_ret 
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raov eax/xDMA' ;OMA controller failure, 

jmp do^reboot 

setupOMA_ret: 

;Set up the Interrupt controllers, 
mov eax,'iPIC* 
mov dx,SMARTVU 
out dx.eax 
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cal I setupPIC 
setupPIC_ret: 

.-Initialize the floppy subsystem. 

mov dx.s lob_portYY ;Read pOPtYY, 

in «l,dx ;Redd it. 

wa fori 0 

or al,siob_portYY_f loppyEn ;Turn on on-bodrd floppy, 
out dx,dl 
waf ori o 

mov eax/iFDC* 
mov dx^SMARTVU 

out dx^efix 

call initfd ;0o the floppy initialization. 

Jnc short doCopy 

mov eax,'xFOC' .-Floppy drive controller failure. 

jDp do reboot 



;Copy the new BIOS froni floppy. 
25 doCopy: 

call copy ;Copy the BIOS from the floppy, 

jnc short getProtected ;Junip if no error in copying. 



mov eax,'xfCP' ; Floppy copy error, 

jnp do_reboot 



;Go to real mode to do the floppy stuff. 
getProtected: 

mov eax , 'pMod ' 

mov dx,SMARTVU 

out dx,eax 

call pMode2 

40 ;Check if we indeed have a semi - legi t imate BIOS, 

mov eax, 'SANE' 
mov dx,SMARTVU 
out dx.eax 
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cdU sdnityCheck 
jnc progrdolt 

5 nov eax/xSAN' ;We co not have a legi BIOS, 

jmp do^reboot 

;Progran the FUsh with the new BIOS, 
prograoitt: 

call program ;Go and program the Flash, 

jc short bootFlashError 

nov cx,800h ;Set frequency, 

mov di, offset beep_ret2 
jmp beep 
beep_ret2: 

nov ax.G0TD_64K_RAM ;Set ss • cs. 

20 nov ss,ax 

jmp f Ush_prog_olc ;0i splay '£N0' message. 

bootPlashError: 

mov eax, *xPRG* 
jmp do_reboot 

bootFlash erdp 
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Other Procedures 
The actual assembly language realization used contains numerous other 
^ procedures, which wUl now be detailed. Most of these procedures are 
completely conventional. However, any of these procedures which have any 
particular relevance to the claimed inventions are actually listed below. 

10 

INITSTIJFF 

This procedure initializes the "SLOB" and 'TRANE" chips. 

15 ; - _ 

public initStuff 
InitStuff proc near 

Initialize SLOB. 

mov eax/iSL8* 
aov dx.SMARTVU 
out dx.eax 

Initialize slob_configA (0CA2h). 
bitO:3 — > CPUtype. 
bit4 — > 8742 installed, 
bits "> NVRAM installed, 
bits --> Password. 

bit? --> Lower bay installed. (Ignore for proto BIOS and desktop) 

mov dx,s lob_conf igA ;Read configA. 

in a t , dx 

and al ,s tob_conf igA^nvRdmIn+slob_configA_8742in;Isolate the bits, 
out dx.dl ;b1tO:3 and bit? is read-only, 

;bit6 is written with a 0, 
; this should not affect the state 
; of the password. 
;bit4 - 8?42 installed. 
; if read is 0, 8?42 is installed, 
then write 0 to tell the 106 
to disable its own Icyb cntrl. 
; if read is 1, 8?42 not installed, 
then write I to tell the 106 
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to enabled its own kyb cntrl. 
bits - NVRAM installed. 

if read is 0, NVRAM is installed, 
then write 0 to tell SLOB to 
disable FLASH, 
if read is I, NVRAM not installed, 
then write I to telt SLOB to 
enable FLASH. 



Initialize slob_^portYY (OCASh) . 
ON RESET: 

bitO - 0 — > Floppy disabled. 

bit! - 0 --> IDE interrupt disabled. 

bit2 - 1 --> Primary hd cntrl. 

bit3 - 0 --> Mono. 

bit4 - 1 — > Gate A20 set. 

bits « I "> Kyb command enabled, no Intercept. 

bite ' 1 "> BIOS reset on. 

bit? - 0 — > Relay off. (Ignore for desktop) 

mov dx,s lob_portYY ;Read portYY. 

in a I ,dx 

and al^not (s lob_portYY_gateA20+s lob_portYY_lcA20cmdEn+s lob_portYY_bi osRstOrv) 
; Reset A20, 

;Enable kyb command intercept. 
;6I0S reset off. 

out dx,at 
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Initialize slob_pcrtXX (0CA6hJ . 
ON RESET: 

bitO » 1 --> RSTNMI inactive (read-onlyj. 

bitl:2 - 0 "> Speaker off. 

bit3 - 0 "> FLASH program/erase disabled. 

bit4 = I — > Native mode. 

bits « 0 — > SMVU reset enabled. 

bits - 0 — > Mouse IRQ enabled. 

bit? - 0 — > Flush disabled. 
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mov dx,slob_portXX 
tnov aUOlOlOUlb 
out dx,al 



; Write portXX. 
;bit7 - disable flush. 
;bit6 = mouse IRQ disabled. 
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;bit5 * sraVu reset endbled. 

;bi t4 " native mode. 

;bit3 • fUsh erase/program disabled. 

;bit2:l ■ speaker on HtGH. 

;bitO read only (RSTNMI). 



Initialize slob_portZZ (0CA7h) . 
ON RESET: 

bItO - 0 "> VGA disabled. 

bitl - 0 "> VGA reset on. 

bitZ - 0 "> VGA IRQ9 disabled. 

bit3 - 0 --> IDE SLVACT masked. 

bit4 - 1 --> don't cares (read-only). 



mov dx, s lob^portZZ 
nov dMUlOOOlb 
out dx,al 
mov aMlUOOllb 
out dx.at 



; Write portZZ. 
;VGA enabled. 

;VGA reset off. 



Don't need to initialize cpu types; POST will (0CA2h and 0CA3h) . 



Initialize the phantom counter control register, slob peer (OCAOh) . 



wrc?7? 
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Initialize s lob_power_gDod_mdsk (OCAlh). 
This register does not need initialization; defaults to 
3Fh. This register sets the time for stabling power output 
for a tower system when the relay to the lower drive bay kicks in. 
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Initialize slob_configB (0CA3h) . 

This register does not need initialization. 
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Initialize slob_extRom C0CA4h) . 
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; This register does not need ini tid li Cdtion. 
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Inttidlize RAM 



mov e«5x, ' i RAM' 
mov dx^SKARTVU 
out dx.edx 

mov bp, OFFSET i ni tRAM_ret ;Point 5p to near return address, 
jmp RAM_init /Initialize Trane. 

initRAM^ret: 

;Map in the first availabLe SIMM at 0-2Mb. 

mov dl,CMSMTPL+NMIOFF 

out CMOSAO^al 

in dl.CMOSOT ;Get SIMM map from CMOS. 

20 movzx bx,dl ;S<ive SIW configuration in bx. 

mov bp,es 

shl ebp,16 ;ES into hi word of eax. 

mov bp,ds ;Save ds. 

mov ax,GDT0_4G ;4G data seg ... 

mov ds,ax ;into ds. 

mov es ,dx ; into es. 

findSlMMZ: bsf dx,bx ;Find first installed SIMM position. 

jnz SHORT mapSIMMZ ;lf a SI^W is found, map it in $ 0. 

mov eax/fRAW' ;Can't find any RAM. 

mov cx,0 ; Delay forever, 

jmp fldsh^msg ;Oisplay error message. 



mdpSlMMZ: TRANE_CUT_IX TRANE_RCROM,d I ;Progran 1st SIMM at 0 as d 256kbit part. 



; Copy 8k boot from ROM to RAM dt UeCOOh (IM + 123)c - Qk) , 
mov ecx,2000h SHR 2 ;8kb == 2k DWORDs, 

mov edi^lOOOOh ;Oestindtion in RAM above IM. 

mov esi ,OffffeOOOh ;Source in 4G ROM. 

eld ;Forward MOVSD. 

AOSIZE 

rep movsd ;move 8k boot from 4G ROM to RAM above IM. 
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; Check the RAM code against ROM to verify the copy and validate RAM 
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pov ecx,2000h SHR 2 ;aJcb 2k DWORDs, 

mov edi,lOOOOh ;Oest i nat ion string in RAM above IM. 

mov esi .Off ffeOOOh ;Source string in 4G ROM. 

A0SI2E 

repe crapsd ; Search for non-natch ing DWORD, 

je SHORT jnpZRAWZ ;If RAM/ROM mdtch then jump to the RAW code. 

; If the 8k boot in RAM is corrupted then assuoe that SIMM is bdd and 
; marie it out in CMOS. Go back and look for the next good SIMM. 

btr bx,dx ;Reset the current SIMM bit in the map. 

mov al,CMSMTPL+NMIOFF 
out CMOSAO.al 
mov a 1 , b I 

out CMOSDT^al ;Disable the SIMM in the CMOS map. 

jmp finds W2 ;Look for the next good SI.M. 

; Junp into the 8k boot code that has been copied to RA.M. 
jmp2RAM2: mov cs.bp .'Restore ds. 

shr ebp, 16 
mov es.bp 

JMPP GDTC_64k_RAM ;Load cs with selector for IM RAM code. 

;Re locate the GOT. 
0PSI2E 

tgdt fword ptr cs : rani54_gdt_ptr 

30 initStuffOone: 
ret 

initStuff endp 

35 

RAMj/iit 

Procedure RAMJnit performs RAM initialization for the 8k boot code, 
^ initializes TRANE, identifies memory, initializes it, turns on refresh and points 
RCRO to a block from 0 - 2Mb. 
Inputs: 

45 HSM XX ... Host state machine initialization tables. 
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FS ... Must point to a 4Gb data selector based @ 0. 
bp coatains the return address. 

NOTE: It doesn*t matter what type of SIMM we 

have identified. The presence test assumes that it's a 256kbit chip 
and initializes the RCR accordingly. If it's actually a 1Mbit or a 
4Mbit SIMM it should still behave ok if it's programmed as a 
256kbit. Since all we need is 128kb of RAM for copying the 
UVPROM, who cares what size the SIMM really is? 

Outputs: 

SUCCESS ... If successful, returns the following: 

- All SIMMs identified as present or not and 
tabulated in CMSMTPL below. 

CMSMTPL ... CMOS byte containing the SIMM map. 

- RCROM points to 2 Mb of DRAM. SIMMs for this RAS 
programmed as 256kbit devices. 

- Refresh enabled. 

FAILURE ... If no RAM can be found, issues TElAM' to 
Smart Vu and waits forever. 

SINIT_VL106 

Procedure $initjll06 initializes the vll06. The VL106 is a chip which, 
among other functions, replaces the 8742 keyboard handler.) 
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PMODE 

5 This procedure is a Protected mode entry routine. 

Inputs: 

DS ... points to the segment containing "gdtjjtr" and 
10 NULL_IDT. 

RMODE 

15 This routine is created for the floppy code to run in real mode. 

Inputs: none. 
Outputs: real mode. 

20 

PMODE2 

This routine is created for the floppy code. This will switch the 
25 execution back to protected after the floppy code is executed. [Uses diEferent 

IDT and GDT tables ub low RAM.] 

Inputs: none. 
30 Outputs: protected mode. 

CMOSSUM 

35 This routine checksums the CMOS range lOh thru 2Dh. 

Inputs: 

DI ... contains NEAR return offset. 
40 Outputs: none. 

FLASH MSG 

^5 Procedure flash jnsg displays the SMAJRTVU message in E.AX, waits 
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CX seconds and returns to the NEAR address in DI. 
Inputs: 

SS ... Writable segment pointing to code. 
Dl ... Contains the NEAR return address. 
CX ... The number of seconds to delay after displaying the 
SNLARTVU message. 

EAX ... Contains the SmartVu message. 

DELAY 

Procedure delay waits for CX seconds. This procedure uses the RTC to 
implement a delay specified by the count in seconds in CX. If the RTC battery 
is bad, we just execute a fixed delay loop of DUMMY_DELAY iterations. 
Inputs: 

cx ... Countains the number of seconds to delay. 
GET SEC 

This routine reads the seconds count from the RTC (real-time clock), 
and waits if a time update is in progress. 
Inputs: 

SI ... Contains the NE.AR return address. 

Outputs: 

AL ... Contains the RTC seconds count. 
BEEP 

This routine beeps! 

Inputs: 
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cx = frequency. 

di = near return address. 

Outputs: 

none. 

INIT TIMER 
This routine tests and initializes the timers. 

SETUPDMA 

Procedure setupDMA will set up the DMA controllers just like the 
regular POST, The code are identical so as not to introduce any problem wth 
the INT13H routine. 
Inputs: 

Native mode, protected mode. 

Outputs: 

K error, let regular POST reports the error. 

If no error, DMA controllers are now ready for the INT13H 

routine. 

SETUPPIC 

Procedure setupPIC will set up the PICs just like the regular POST. The 
code is identical to that used in the POST, so as not to introduce any problem 
with the INT13H routine. 
Inputs: 

Native mode, protected mode. 

Outputs: 
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The PICs are now ready for the INT13H routine. 

5 

COFY 

Procedure copy copies the new BIOS from the floppy to RAM. The 
steps are as follow: 

' Find out if file exists. The file has to be on a 1.2M 
floppy in the root directory with a filename of "DELLBIOS.BIN". 
Inputs: 

none. 

Outputs: 

Carry flag set if error. 

20 



public copy 

25 copy proc ne£ 

mov eax, 'ROOT* 
mov dx,SMARTVU 
cut dx.eax 
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call flleExist ;Find out if file exists? 

jnc short gotRoot ;Jump if file exists. 

mov dx^fdcOOR ; Access fdcDCR. 

mov dl.OCh ;Turn off motor, disabled interrupts 

; and DMA. 

out dx,al 



40 mov eax, 'xROM* 

jmp do_reboot 
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gotRoot: 

push eau 
push dx 
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mov eax/COPY* 
mov dx,SMARTVU 
out dx,efix 
pop dx 
pop eax 

call copyFile ;Go and try to copy fite. 

; Return with carry set if error, 
nov dx,fdcOOR ;Access fdcDOR. 

mov al,OCh ;Turn off motor, disabled interrupts 

; and DMA. 



;Exit if no error from copyFile? 



40 



out dx,al 

jnc short exitt 

nov eax, 'xCPY ' 

Jmp do_reboot 

exitt: 
ret 

copy endp 



FILEEXIST 

Procedure fileExist reads in the root directory, and searches to see 
whether file "DELLBIOS.BIN" is in the director>'. 
Inputs: 

none. 

Outputs: 

Carry clear if file exists. 

ax has the first disk cluster if file exists. 

bx:dx has file size. 
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SETTYPE 

Procedure setType determines the type of floppy drive and sets the drive 
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parameters accordingly. 
Inputs: 

none. 

Outputs: 

Parameters are initialized. 
COPYFfLE 

Procedure copyFile copies the desired file from drive 0 to RAM. 
The steps are as follow: 

- Make sure the file size is what we expected. 

- Read the FAT table. 

- Copy the file to DRAM. 

Inputs: 

ax has the first disk cluster of the file. 
bx:dx has file size. 
es = GDTD_BUFFER. 

Outputs: 

Carry flag set if error. 
SANTTYCHECK 

Procedure sanicyCheck will try to verify that the BIOS copied is a 
legitimate Dell BIOS. 
Inputs: 

BIOS (112K) spans from 5000:0000 thru 6000:COOO. 

Outputs: 

Carry set if we do not have a legi BIOS. 
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public sanftyCheck 

5 sanftyCheck proc near 

push ds 

push eax 

push ebx 

'0 push ecx 

push esi 

;Check the Oetl signdture. 

C3i: dword ptr ds: [05£076h] / I teO' 
jnt; illegitimate 
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;0o noi byte checksum the BIOS since we have dword XOR. 
if 0 

;Checksum the system and video BIOS, 
xor ecx, ecx 

mov cl,byte ptr ds; [060002h] ; Video ROM size in 512-byte bloc 
shl ecx, 9 ;Convert to bytes, 

add ecx,64»1024 ;Add the size of the system ROM. 

25 nov ah,0 initialize checksum. 

fflov esi,050000h ;Initialize pointer, 

cld ;Set to increment. 

saniLoop: 
ADS12E 

lodsb ;al has value, 

add ah, a I ;Add value to ah. 

ADSIZE 

loop saniLoop 

or ah, ah ;BIOS checksum good? 

jnz short illegitimate ;Jump if bad checkuo. 

end if ;0 

40 ;Check the XOR of the 96K BIOS. 

mov ebx, dword ptr ds: [05E842h] ;Get the system BIOS version, 
mov cx,50h/4 ;0o 20 dwords . 

mov es1,050000h 
sanlLoopi: 

45 
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AOSIZE 
lodsd 

xop ebx.cdx 
5 loop saniLoopl 

niov cx,(96M024/4)-22 ;0o 24K dworcs - 22 dwords 
tnov esi.OSOOSSh 
saniLoop2: 
10 ADSIZE 
lodsd 

xor ebx,eax 

loop saniLoop2 
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cmp ebx,dword ptr ds:[050050h] 

jne short illegitimate ;Junp if bad XOR. 



saniExit: 

pop ecx 

pop ebx 

pop eax 

pop ds 



ret 

i I legitimate: 
stc 

jmp short saniExit 
sanityCheck endp 

NEXT 

Procedure next gets the next link from a 12-bit FAT. 

Input: 

ax = current entry number. 

Output: 

ax = next element in the chain. 
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REL2ABS 

Procedure rellabs converts the relative sector number to the absolute 
sector location. 
Input: 

ax = relative sector number. 

Output: 

ch = track number, 
cl = sector number, 
dh = head number, 
dl = 0 = drive number. 

GETFAT 

Procedure getFcU reads in the FAT table. 

Inputs: 

es = GDTDBUFFER. 

Outputs: 

Carry set if error. 

If successful, FAT resides from 4000:0000 thru 4000:OEOO. 
PROGRAM 

Procedure program writes data into the flash ROM. 

Inputs: 

none. 

Outputs: 

Carry set if error. 
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public program 



program proc 



push 
push 



ds 
es 



10 



oov 4x,GDT0_4G 
nov ds.dx 
mov es,ax 



;Flat address. 
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call enabte_fPrograra ;£nable flash progratnniing. 

call setNCA ;Set up one NCA descriptor. 

;0o the U2k BIOS and video sector. 

mov es1,50000h ;Offset of buffer, 

mov edi.OFFFEOOOOh ;Start of sector 

mov ecx,lCOO0h ;U2k. 



25 



push eax 
oov eax, ' ERAZ ' 
mov dx.SMARTVU 
out dx.eax 
pop eax 
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call €rase_sector 
jc short bad_fldsh 

push ^ eax 
mov eax, 'PROG* 
raov dx,SMARTV!J 
out dx,eax 
pop eax 
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call program_sector 
jc short bad_fUsh 

call disable_fProgram 
clc 



;Oisabte flash progratnrain 
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flash done: 
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pop es 
pop ds 

5 ret 

bad_f lash : 

call disable_fProgram .-Disable flash programming, 

stc 

jtnp short flash_done 
program endp 



ERASE SECTOR 
Procedure erase jector performs the following steps: 

- Clear the status register. 

- Set the FLASH to read status mode. 

- Set the FLASH for erase. 

- Do the erase. 

- Verify the erase is successful by reading the 
stams register. 

- Set the carry Qag if erase unsuccessful. 

- Clear . the status register. 

- Set the FLASH to read array mode. 

Inputs: 

es:edi = address of sector to be erased, 

FLASH program/erase better be enabled before calling this 

routine. 

Outputs: 

If successful, carry flag cleared. 
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; WARNING!!! - The FLASH program jumper must be set for program/erase. 



public erase_sectcr 

erase_sector proc nesr 

push esi ;Sdve esi . 

push edi ;Save edi . 

push ecx ;Save ex. 

push dx ;Sdve ax. 

push dx ;Save dx. 

call clr Flash status 



20 push ecx 

mov- cx,300 
call usecWait 
pop ecx 



oov byte ptr es : [edi] , f lash_erase_setup;Get ready to erase. 

push ecx 
aov cx,300 
call usecWatt 
pop ecx 

nov byte ptr cs : [edi] , f tash_erase_go;Oo the erase. 



35 push ecx 

mov cx,300 
call usecWait 
pop ecx 



nov ecx,0 ; Software timeout. 

erase_sector_wai t: 

call read_Flash_status ;Put status in al. 
test dl , flash_status_wsni_busy; Erase finish yet? 
jz erase_sector wai t 
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loopz erdse_sector_wdi t ;jLnip if not done, 
jz short erase_sector_err ;Junip if times out. 

test dt, f tash_status__^erase_fdi I + f lash_status_vpp_low;£rdse fdi I? 
jnz short erdse_sector_err jJump if erase fail, 

clear_erase_5cctor status: 
call clr_Flash_status 

mov byte ptr es : [edi ] , f lash_read ;Set the FUSH to read array mode, 
clc 

erase_sector_done: 

pop dx ; Res tore dx. 

pop ax ; Res tore ax. 

pop ecx ; Restore ex. 

20 pop edi ;Restore edi. 

pop esi ;Restore esi. 
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ret 

erase^sector err: 

call clr_Flash_status 

raov byte ptr es:[edi] , f tdsh_read;Set the FLASH to read array mode, 
stc 

jmp short erase_sector_dor.e 
erase_sector endp 

PROGRAM SECTOR 
Procedure program jector writes a sector of the flash ROM. 

Inputs: 

ecx = number of bytes to program. 
ds:esi points to beginning of data, 
esredi points to beginning of sector. 
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The steps are as follow: 

- Clear the status register, 

- Set the FLASH to read status mode. 

- Go and program the sector. 

- Abort if error with the carry flag set. 

10 

• Clear the status register. 

- Set the FLASH to read array mode. 

Outputs: 

f5 

If successful, carry flag cleared. 
; WARNING!!! - The FLASH program jumper must be set for program/erase. 



25 
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public prog rara_sec tor 
prog ram^sec tor proc near 



push eax ;Save ax. 

2Q push ecx ;Save ex. 

push esi ;Save esi , 

push edi ;Save edi . 



call clr Ftdsh status 



eld 



froin_esi : 

;ecx - byte counts. 

40 

mov byte ptr es : [edi ] , f lash_prograB_setup;Get ready to program, 
mov at, byte ptr ds:[esi] 
mov byte ptr es:[edi],al 

45 push ecx 
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nov ex. 5 

ca 1 1 usecWa i t 
pop ecx 

inc esi 
inc ed) 

ADSIZE 

loop from esi 



mov ecx,0 ; Software timeout. 

progpam_new_wai t; 
15 call read^f Ush_status ;Put status in al. 

test a I , f lash_status_wsm_busy;Progpa(n finish yet? 
Jz short program_new_wai t 

loopz program_new__wait ;Ju(np if not done. 



}Z short program_sector_err ;Jump if times out. 

test al,f lash_status_prog_fai l+f lash_status_vpp^low;Progrdm fail? 
jnz short progran^sector^err ;Jump if progran fail. 

program_sector_ok; 

call clr_Flash_status 

tnov byte ptr es : [edi] , f lash_read;Set the FLASH to read array mode, 
clc 

prograni_sector_done; 

pop edi ; Res to re edi . 

pop es i ;Restore es i . 

pop ecx ; Restore ex. 

pop cax ;Restore ax. 



prograra_sector_err: 

call clr_riash_status 

mov byte ptr es : [edi] , f lash_readjSet the FLASH to read array mode. 



45 stc 
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jrap short progrdci^sector^done 
progpdffl^sector endp 



ENABLE fPROGRAM 
Procedure enable JProgram enables program/erase operations on the 
FLASH ROM. 
Inputs: none. 
Outputs: 

15 FLASH is ready to be programmed or erased. 



enable_f Program proc near 

push ax ;Save ax. 

push dx ;Save dx. 



mov dx,s lob_portXX ;Access portXX. 

25 in al,dx ;Read in current value, 

waforio 

or a l,slob_portXX_f IhPrg ;Enable FLASH program/erase, 
out dx,al ;Write out the new value. 



pop dx ; Restore dx. 

pop ax ; Re store ax. 

ret 

enable_fPrograiD endp 

DISABLE JPROGRAM 
Procedure disable JProgram disables FLASH program/erase. 
Inputs: none. 

Outputs: FLASH cannot be programmed or erased. 
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di sdble^fPrograro proc near 

push dx ;Save ax. 

push dx ;Save dx. 

mov dx,slob_portXX .'Access poPtXX. 

tn dl,dx ;Redd in current value. 

waforio 

and al,not slob_portXX_flhPrg;Oi sable FLASH program/erase, 
out dx,al ;Write out the new value. 

pop dx ; Res tore dx. 

pop ax ; Res tore ax, 

ret 

disable_fProgram endp 

USECWATT 

Procedure usecWait creates cx microseconds of delay. 

Inputs: 

cx = number of usee. 

Outputs: 

cx destroyed. 

CLRFLASHSTA TUS 
Procedure clr_Flashjtcuxis clears the FLASH status register. This 
routine was created because the new spec requires the address to be at OOOOOh 
of the Flash. 

Inputs: none. 

Outputs: Flash status register cleared. 
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clr_FUsh_status proc near 

;NOrE: Do not need to save the entry mode. It will always be natfve mode. 

push ax 
push ds 
push ecx 

fflov ax,GDT0_4G ;<Gb descriptor, 

nov ds,ax 

nov byte ptr ds : [OFFFFEOOOh] , f lash_c lear_status 

oov cx,l5 

call usecwait 



pop ecx 

20 pop ds 

pop ax 

ret 



clr_Flash_status endp 



READ FLASH STATUS 
30 Procedure read_Flashjtatus reads the FLASH status register at OOOOOh 

of the Fla5h. 

Inputs: none. 
35 Outputs: Flash status register read in al. 



read_Flash_status proc near 

;NOTE: Oo not need to save the entry mode. It will always be native mode. 



push ecx 
push ds 
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nov ax,G0TD_4G ;4Gb descriptor. 

tBov ds.ax 

FLUSH^CACHE 

nov byte ptr ds : [OFFFEOOOCh] , f lash_status 

nov cx,15 

can usecWalt 

mov a I, byte ptr ds : [OFFFECOOOh] 

mov cx,15 

call usecWait 

pop ds 
pop ecx 

ret 

r€ad_Flash_status endp 

NMIISR 

Procedure NMIJSR is a dummy interrupt handler, which swallows 
NMMI interrupt. 

DMATST 

This routine tests the DMA address and word count registers. 

Input: 

CX = # of ports to test 
DX = first port to test 
SI = increment between ports 
Output: flags ? 

AL = ? 
AH = ? 
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CX = 0 

5 CALBJPD 

Procedure CALBJPD ("calibrate speed") sets DLLY^CNT with count 
for 100 us 

10 

FDISR 

Procedure fdlSR is the floppy drive controller interrupt handler. The 
'5 steps are as follow: 

- Send EOI to master PIC 

- Set interrupt bit in DRVSTAT to indicate an interrupt 

20 has occurred. 

INT13H 

Procedure intl3h determines and executes the desired iiitl3h procedure 
functions. 

RESETFLOP 

FzocQdurc resetFlop resets the floppy system. This is part of the INT13H 
procedure. 
^5 Inputs: 

ah = 0 

dl = drive number (0-3), bit? = 0 for floppy. 

^ Outputs: 

Carry flag set if error, 
ah = status/error code. 
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ds:ERRSTAT(FDATA) = ah. 

READSECTOR 
Procedure readSector reads al sectors from the floppy. 

Inputs: 



10 


ah = 02h. 




al = aumber of sectors. 




ch = track aumber. 


15 


cl = sector number. 




dh = head number. 




dl = drive number. 


20 


es:bx = address of buffer. 



Outputs: 

Carry flag set if error. 

al = aumber of sectors transferred, ah = status = ERRSTAT. 
SETCARRY 

Procedure setCarry sets the carry flag on the stack. This is part of the 
INT13H procedure. 

CLRCARRY 

Procedure clrCany clears the carry flag on the stack. This is part of the 
INT13H procedure. 
Inputs: none. 
Outputs: 

Carry flag in the flag register on the stack is cleared. 
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Interrupt flag also set. 
DSKRESET 

Procedure dskReset resets the floppy system. This is part of the INT13H 
procedure. 

The steps are as follow: 

- Disable interrupts. 

- Clear DRVSTAT and ERRSTAT. 

- Get floppy motor status. 

- Issue reset command. 

- Turn off reset command. 

- Enable interrupts and wait for reset result interrupt. 

- Check result. 

Inputs: 

dl = drive number (0-3), bit? = 0 for floppy. 

Outputs: 

Carry flag set if error. 

ds:ERRSTAT(FDATA) = ah - error code if error, else 0. 
WAITINT 

Procedure waitlnt waits for a FDC interrupt. This is part of the LNT13H 
procedure. This routine uses a regular wait instead of intlSh, 
Inputs: none. 
Outputs: 

Carry flag set if timeout enor, else not. 
ERRSTAT bit? = I if timeout. 
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FDCRDY 

Procedure fdcRdy waits for the floppy controller to be ready. This is 
part of the INT13H procedure. 
Inputs: none. 
Outputs: 

Carry flag set if timeout. 
STSSTAT 

Procedure sisStat senses the interrupt status. This is part of the INT13H 
procedure. 
Inputs: none. 
Outputs: 

Carry flag set if error, ERRSTAT set, ah = FDC status, 
else Carry flag clear and al = present cylinder. 

WRTCMDAVRTCMnA 

Procedures wrtCmd and wnCmdA write commands to the FDC, and are 
pan of the INT13H procedure. 
Inputs: 

al = command. 

ds points to FDAT.\, 

Outputs: 

Cany flag and ERRSTAT set if error, 
ah, dx destroyed. 

RSLTRD7/RSLTRn 
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Procedure rsltRd? reads 7 result bytes from the FDC Procedure rsltRd 
reads cx result bytes from the FDC. These are part of the INT13H procedure. 
Inputs: 



al = FDC status. 

ah = FDC STO, only valid if no carry. 

ERRSTAT bit 7 = 1, cany set on timeout. 

ERRSTAT bit 5 = 1, carry set if FDC results cannot be flushed. 

Carry set if less results available than expected. 

DSKST = FDC STO, only vaUd if no carry. 

dx non-zero. 

I82077EXIST 

Procedure i82077exist determines if a i82077 FDC is installed. 
This is part of the 1NT13H procedure. 
Inputs: none. 
Outputs: 

Carr>' flag set if 182077 installed and the FIFO enabled, 
stkjmp bitO= 1 if i82077 installed and bitl= 1 if HFO enabled. 

MLTCMD2/MLTCMD 
Procedure mltCmdl writes 2 commands to the FDC. Procedure mltCmd 
writes cx commands to the FDC. These are part of the INT13H procedure. 



cx = number of result bytes to read, 
ds points to FDATA. 
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Outputs: 



Inputs: 
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cx = number of bytes to write (mJtCmd). 
bx = starting table offset. 

Outputs: 

es:si = disk parameter block. 

ERRSTAT bit7=l on timeout. bit5 = l on controUer error. 
Carry flag set on timeout or controUer error, else not set. 



DPBADR 

Procedure dpbAdr puts tiie address of the disk parameter block into 
es:di. This is pan of the INTISH procedure. 
Inputs: none. 

Outputs: es:si points to disk parameter block. 



Procedure configure issues the configure command to enable the FIFO 
in the i82077 FDC. This is part of the INT13H procedure. 
Inputs: 

ah = hyte 2 of configure command. 

Outputs: 

Carry flag set if FDC error, else cleared. 
DSKMOT 

Procedure dskMot turns the floppy drive motor on. This is part of the 
INT13H procedure. 
Inputs: 

dl = drive number. 
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Outputs: none. 

CHKCHG 

Procedure chkChg checks the change line on the floppy drive. This is 
part of the EvmSH procedure. 
Inputs: none. 

Outputs: Cany flag set if error. 

GETDRVrNFO 

Procedure getDrvInfo gets drive information from HDCFLG. This is 
part of the INT13H procedure. 
Inputs: none. 
Outputs: 

Low 3 bits of al = drive information. 
CLRCHG 

Procedure clrChg tests and clear the change line. This is part of the 
INT13H procedure. 
Inputs: 

dl = drive number. 

Outputs: 

Cany flag set if timeout, 

ERRSTAT = timeout or change line error. 

DOSEEK/DOSEEK7 
Procedures doSeek and doSeekl will seek to track specified by ch. This 
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is part of the INT13H procedure. 
Inputs: 

ch = track to seek. 

Outputs: 

Cany flag and ERRSTAT set if error. 
DRIHEDSEL 

Procedure driHedSel loads the head (HDS) and the drive (DSl, DSO) 
parameters to the FDC. This is pan of the DsTlSH procedure. 
Inputs: none. 
Outputs: none. 

[NTTDMA 

Procedure initDMA will initialize the DMA controller for floppy 
operations. This is part of the INT13H procedure. 
Inputs: none. 
Outputs: 

Carry flag and ERRSTAT set if error. 
HEADSETTLE 

Procedure headSettle conditionally waits for the head to settle. This is 
part of the INT13H procedure. 
Inputs: 

dx aon-zero if head settle wait needed. 

Outputs: 

es:si points to DPB. 
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spimrp 

Procedure spinup conditionally waits for the floppy to spinup. This is 
part of the INT13H procedure. 

CHKTYP 

Procedure chkTyp checks the media type. This routine is called prior to 
read/write operation to verify and update, if necessary, FDMED. Returns with 
the cany flag set if no remaining valid FDMEDs to try. This is part of the 
INT13H procedure. 
Inputs: 

FDMED, ERRSTAT (if non-zero, it is a retry), 
bx = drive. 

Outputs: 

FDMED updated: 

ERRSTAT = carry flag = 0 if any more valid rate/step combos. 
FDMED restored: 

FDOPER = 0. 

ERRSTAT and cany flag set if no more vaHd rate/step combos.; 
FDTYPIF 

Procedure /ciTyp// gets floppy disk type from CMOS if CMOS is valid. 
This is part of the n«^13H procedure. 
Inputs: none. 
Outputs: 

Carry flag set if CMOS invalid, else 

al = drive tjpe, zero flag set if no drive or type unknown. 
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top of ah non-zero if another drive. 
FDTYPE 

Pvocedme fdType gets floppy disk type from CMOS. This is part of the 
FDTYPIF routine, and part of the INT13H procedure. 
Inputs: none. 
Outputs: 

al = drive type, zero flag set if no drive or type unknown, 
top of ah non-zero if another drive. 



SETRATE 

Procedure setRate sets the transfer rate. This is part of the INT13H 
procedure. 
Inputs: 

bx = drive number. 

Outputs: 

Rate control pon updated. 



CHKRES 

Procedure chkRes reads and checks the resuhs from the FDC This is 
part of the INTiJH procedure. 
Inputs: none. 
Outputs: 

Carry flag set if error. 

al = number of sectors transferred. 
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AFTERTRY 

Procedure afterTty sets the zero flag if there is still more retry after an 
unsuccessful operation. This is part of the INT13H procedure. 
Inputs: none. 
Outputs: 

Zero flag set if there is still more retry. 
RESTYP 

Procedure resTyp forces FDMED[bx] media known and restores 
compatible low bits. This is part of the INT13H procedure. 
Inputs: 

ah = top three bits of FDMED[bx]. 

Outputs: 

FDMED[bx] bit4 = 1. 
STODRVTNFO 

Procedure stoDrvInfo puts the drive information in al into HDCFLG. 
This is part of the INT13H procedure. 
Inputs: 

al = drive information, 
bx = drive number. 

Outputs: 

Drive information in [bx] half of HDCFLG. 
IMITFD 

Procedure initFD will initialize the floppy subsystem and all the variables 
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used by the INTISH routine. This is part of the INTISH routine. 

Inputs: none. 

Outputs: 

DR VSTAT, FMOTS. FDTIMO, ERRSTAT, DSKST, HDCFLG, 
FDMED, FDOPER, WTACTF, FDRATE, are aU 
initialized. 

DSKTEST 

Procedure dskTest will test aii 'etermine drive type. 

Inputs; 

ss:bp points to stack frame for disk driver. 
stk_dl[bp] = drive number. 

Outputs: 

FDMED[drive #], HDCFLG initialized. 
Carry flag set if no drive. 

Procedure sDrvSt senses the drive status. 
Inputs: none. 
Outputs: 

Carry flag set, ERRSTAT set if error. 
Carry flag clear, ah = FDCs STO if no error. 
Zero flag set if track 0 reached. 

CKFDCFG 

Procedure ckFdCfg checks the floppy configuration data against the 
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actual installed hardware. 
Inputs: 

byte ptr stk_dl[bp] = drive number, 

si points to the media type for that drive number. 

Outputs: 

Carry set if different configuration. 
CMREAD 

Procedure CMREAD is a Subroutine to Read a CMOS register. 

Input: 

AL = CMOS register address to read 

Output: 

AL = CMOS register value 
Interrupt Flag cleared 
Cany Flag cleared 
Zero Fag cleared. 

C\fWRT 

is a Subroutine to Write a CMOS register. 

AH = CMOS register address to write, Bit 7 = 0 enables NMI 
AL = Value to write to CMOS register 

Interrupt Flag cleared 
Carry Flag cleared 
Zero Flag cleared. 

DLYIOO 

Hiis procedure will delay for KX) us. The loop count for the delay 
function is taken from DLY__CN*r. DLY_CNT is set dunng ATPOST, and 
whenever turbo speed is changed by the routine C-ALB_SPD. It takes no inputs 
and gives no outputs. 



This 

Input: 
Output: 
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Further Modifications and Variations 

It will be recognized by those skilled in the art that the innovative concepts disclosed in the present appli- 
cation can be applied in a wide variety of contexts. Moreover, the preferred implementation can be modified 
5 in a tremendous variety of ways. Accordingly, it should be understood that the modifications and variations sug- 
gested below and above are merely illustrative. These examples may help to show some of the scope of the 
inventive concepts, but these examples do not nearly exhaust the full scope of variations in the disclosed novel 
concepts. 

In particular, the disclosed innovations are not by any means limited to DOS systems, nor to systems using 
10 80x86 microprocessors, nor to systems using a single microprocessor as the CPU. The disclosed innovations 
provide generally applicable architectural techniques, which can be applied to a wide variety of computer sys- 
tems, including high-performance systems and multiprocessing systems. 

It should also be noted that the source for the user-supplied BIOS code does not have to be a floppy drive. 
For example, a tape cartridge or a dial-in telephone interface could be used instead. 
15 In addition, although the Flash EPROM is the preferred device technology for the second nonvolatile u 

memory, it should be recognized that other nonvolatile storage technologies can be used if they become prac- 
tical. Thus, many of the innovative features of the presently preferred embodiment can be directly adapted to 
a system using EEPROMs, battery-backed SRAM chips, ferroelectric RAMs, or future technologies. 

It should also be noted that BOTH of the boot memories can be rewriteable nonvolatile memories if desired. 
20 Even though this arrangement provides slightly less robustness than the preferred embodiment, it still provides 
a large added margin of safety over the use of a single rewriteable nonvolatile boot memory. 

As will be recognized by those skilled in the art. the innovative concepts described in the present application 
can be modified and varied over a tremendous range of applications, and accordingly the scope of patented 
subject matter is not limited by any of the specific exemplary teachings given. 

25 



Claims 



1. A computer system including a rewritable non-volatile memory which holds bootstrapping instructions in- 
30 eluding instructions capable of effecting the over-writijig-of instructions held in the rewritable non-volatile 

memory, from an external source, following a hard reset of the system. 

2. A computer system including a rewritable non-volatile memory, a second non-volatile memory which holds 
bootstrapping instructions including instructions capable of effecting the over-writing of instructions held 

35 in the rewritable non-volatile memory from an external source, and means for selecting either the second 

non-volatile memory or the rewritable non-volatile memory as its source of bootstrapping instructions, fol- 
lowing a hard reset of the system. 

3. A computer system as claimed in claim 2, in which the bootstrapping instructions held in the second non- 
^ volatile memory are such as to effect the over-writing of instructions held in the rewritable non-volatile 

memory by the bootstrapping instructions held in the second nonvolatile memory, following a hard reset 
of the system. 



45 



4. A computer system as claimed in claim 2 or claim 3, which includes a user settable switch for selecting 
the'second non-volatile memory initially as its source of bootstrapping instructions and which is capable 
of reversing the switch setting to select the rewritable non-volatile memory as its source of bootstrapping 
instructions thereafter. 

5. A computer system as claimed in any one of claims 2 to 4, wherein the second non-volatile memory is a 
rewritable memory and includes means for preventing its data from being overwritten. 

6. A computer system as claimed in any one of claims 1 to 5, including manually operable means which has 
a first setting for preventing the over-writing of instructions held in the rewritable non-volatile memory and 
a second setting for permitting the over-writing of instructions held in the rewritable non-volatile memory. 

55 7. A computer system as claimed in any one of claims 1 to 6. including a multi-element diagnostic display 
capable of indicating the result of an operation to over-write instructions held in the rewritable non-volatile 
memory. 
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8. A method of operating a computer system inctuding the steps of first writing bootstrapping instructions 
from a second non-volatile memory to a rewritable non-volatile memory following a hard reset of the sys- 
tem and. thereafter, reading the bootstrapping instructions from the rewritable non-volatile memory in 
bootstrapping the computer system, 

5 

9. A method of operating a computer system as claimed in claim 8. including the steps of reading initial boot- 
strapping instructions from the rewritable non-volatile memory in bootstrapping the computer system and 
overwriting the remaining bootstrapping instructions in the rewritable non-volatile memory with data from 
an external source. 

10 

10. A method of operating a computer system as claimed in claim 8 or claim 9, including the steps of reading 
bootstrapping instructions from the rewritable nonvolatile memory, subjecting the bootstrapping instruc- 
tions to validity checks as they are read and, when a validity check is failed, over-writing the bootstrapping 
instructions held in the rewritable non-volatile memory with the bootstrapping instructions held in the sec- 

^2 ond non-volatile memory. 
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Figure 1 
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